Vulnerability · Published Dec 19, 2025 · Assigned by Foxit
CVE-2025-13941Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability
High 8.8
In plain English
A high-severity incorrect permission assignment in Foxit PDF Editor from Foxit Software Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Official description
A local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service. During plugin installation, incorrect file system permissions are assigned to resources used by the update service. A local attacker with low privileges could modify or replace these resources, which are later executed by the service, resulting in execution of arbitrary code with SYSTEM privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Foxit Software Inc. | Foxit PDF Reader | Versions 2025.2.1 and earlierVersions 14.0.1 and earlierVersions 13.2.1 and eariler |
| Foxit Software Inc. | Foxit PDF Editor | Versions 2025.2.1 and earlierVersions 14.0.1 and earlierVersions 13.2.1 and eariler |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H